Software / code / prosody
Annotate
tools/form2table.lua @ 13843:87dd8639f08f 13.0
mod_invites_register: Stricter validation of registration events
This fixes two problems:
1) Account invites that were created with a specific username were not
in fact restricted to that username.
2) Password reset invites were not restricted to resetting passwords,
but could be used to create an arbitrary new account if the client
or registration frontend (e.g. mod_invites_register_web) doesn't
handle/enforce the username.
This new validation ensures that registrations and resets are always for the
username specified in the invitation.
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Thu, 10 Apr 2025 16:07:32 +0100 |
| parent | 13142:879a6a33c21b |
| rev | line source |
|---|---|
|
11194
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
1 -- Read an XML dataform and spit out a serialized Lua table of it |
|
13142
879a6a33c21b
tools: Update imports to use new prosody.* namespace
Kim Alvefur <zash@zash.se>
parents:
11194
diff
changeset
|
2 if not pcall(require, "prosody.loader") then |
|
879a6a33c21b
tools: Update imports to use new prosody.* namespace
Kim Alvefur <zash@zash.se>
parents:
11194
diff
changeset
|
3 pcall(require, "loader"); |
|
879a6a33c21b
tools: Update imports to use new prosody.* namespace
Kim Alvefur <zash@zash.se>
parents:
11194
diff
changeset
|
4 end |
|
11194
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
5 |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
6 local function from_stanza(stanza) |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
7 local layout = { |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
8 title = stanza:get_child_text("title"); |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
9 instructions = stanza:get_child_text("instructions"); |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
10 }; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
11 for tag in stanza:childtags("field") do |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
12 local field = { |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
13 name = tag.attr.var; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
14 type = tag.attr.type; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
15 label = tag.attr.label; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
16 desc = tag:get_child_text("desc"); |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
17 required = tag:get_child("required") and true or nil; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
18 value = tag:get_child_text("value"); |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
19 options = nil; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
20 }; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
21 |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
22 if field.type == "list-single" or field.type == "list-multi" then |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
23 local options = {}; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
24 for option in tag:childtags("option") do |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
25 options[#options+1] = { label = option.attr.label, value = option:get_child_text("value") }; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
26 end |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
27 field.options = options; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
28 end |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
29 |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
30 if field.type == "jid-multi" or field.type == "list-multi" or field.type == "text-multi" then |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
31 local values = {}; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
32 for value in tag:childtags("value") do |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
33 values[#values+1] = value:get_text(); |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
34 end |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
35 if field.type == "text-multi" then |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
36 values = table.concat(values, "\n"); |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
37 end |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
38 field.value = values; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
39 end |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
40 |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
41 if field.type == "boolean" then |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
42 field.value = field.value == "true" or field.value == "1"; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
43 end |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
44 |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
45 layout[#layout+1] = field; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
46 |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
47 end |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
48 return layout; |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
49 end |
|
9d1ce6f28401
tools/form2table: Convert XEP-0004 dataform from XML to util.dataforms Lua format
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
50 |
|
13142
879a6a33c21b
tools: Update imports to use new prosody.* namespace
Kim Alvefur <zash@zash.se>
parents:
11194
diff
changeset
|
51 print("dataforms.new " .. require"prosody.util.serialization".serialize(from_stanza(require"prosody.util.xml".parse(io.read("*a"))), |
|
879a6a33c21b
tools: Update imports to use new prosody.* namespace
Kim Alvefur <zash@zash.se>
parents:
11194
diff
changeset
|
52 { unquoted = true })) |